[113146] in North American Network Operators' Group
Re: Nipper and Cisco configuration results
daemon@ATHENA.MIT.EDU (Subba Rao)
Fri Apr 3 22:44:44 2009
Date: Fri, 3 Apr 2009 19:42:38 -0700 (PDT)
From: Subba Rao <castellan2004-nsm@yahoo.com>
To: nanog <nanog@nanog.org>, Christopher <chrismcc@pricegrabber.com>
Reply-To: castellan2004-nsm@yahoo.com
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
I did see a few false positives too with Nipper.=A0 What do you think about=
Router Audit Tool (RAT) instead?=A0 I downloaded ncat (aka RAT), but it do=
es not have a global configuration file which I can use for all the routers=
and switches I have.=A0 Any tips on ncat/RAT configuration?=A0 I could not=
find any examples on using ncat.
Subba Rao
--- On Fri, 4/3/09, Christopher <chrismcc@pricegrabber.com> wrote:
From: Christopher <chrismcc@pricegrabber.com>
Subject: Re: Nipper and Cisco configuration results
To: "nanog" <nanog@nanog.org>
Date: Friday, April 3, 2009, 12:36 PM
On Thu, 2009-04-02 at 15:33 -0700, Subba Rao wrote:
> I am using Nipper for verifying my Cisco configuration.=A0 Nipper is
>=A0 finding the "rlogin" service that is not in the configuration.=A0 I ha=
ve
>=A0 searched the access lists and do not see it anywhere.=A0 The explanati=
on
>=A0 by Nipper about this finding, "....Telnet protocol implemented by this
>=A0 service...." is confusing.
The problem, IMHO, is nipper.=A0 You might or might not have the rlogin
service enabled, but nipper has so many false positives I find is almost
useless.=A0 In my case, it caught some obvious things I had forgotten to
do, but everything else was useless.=A0 For instance from the nipper
source code:
struct vulnerability report_vuln_ios11 =3D {9, 0, 0, 12, 4, 0,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 "CVE-2007-0479", "22208=
",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 "IPv4 TCP listener deni=
al of service",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 true, false,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 vuln_req_none, false, &=
report_vuln_ios12};
What the above means to nipper is any IOS version 12.0.x, 12.1.x,
12.2.x, 12.3.x is vulnerable, while every 12.4.x version is OK.=A0 This is
obviously false on *both* counts.=A0=20
http://www.cisco.com/en/US/products/products_security_advisory09186a00807cb=
0e4.shtml
I spent a lot of time trying to explain this to $corporate audit guy
that had never even logged into a router, let alone had to choose a
stable IOS version for 6500/7600 class hardware.
>=A0=A0=A0Here is the Nipper's output:
>=20
<snip>
> Thank you in advance for any help.
>=20
> Subba Rao
--=20
Christopher McCrory
"The guy that keeps the servers running"
=20
chrismcc@pricegrabber.com
http://www.pricegrabber.com
=20
To the optimist, the glass is half full.
To the pessimist, the glass is half empty.
To the engineer, the glass is twice as big as it needs to be.
